/*     */ package com.zimbra.cs.account.grouphandler;
/*     */ 
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.Log;
/*     */ import com.zimbra.common.util.ZimbraLog;
/*     */ import com.zimbra.cs.account.Account;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.EntryCacheDataKey;
/*     */ import com.zimbra.cs.account.Provisioning;
/*     */ import com.zimbra.cs.account.accesscontrol.ExternalGroup;
/*     */ import com.zimbra.cs.account.auth.AuthMechanism.AuthMech;
/*     */ import com.zimbra.cs.account.ldap.LdapHelper;
/*     */ import com.zimbra.cs.account.ldap.LdapProv;
/*     */ import com.zimbra.cs.ldap.IAttributes;
/*     */ import com.zimbra.cs.ldap.IAttributes.CheckBinary;
/*     */ import com.zimbra.cs.ldap.ILdapContext;
/*     */ import com.zimbra.cs.ldap.LdapClient;
/*     */ import com.zimbra.cs.ldap.LdapUtil;
/*     */ import com.zimbra.cs.ldap.SearchLdapOptions;
/*     */ import com.zimbra.cs.ldap.SearchLdapOptions.SearchLdapVisitor;
/*     */ import com.zimbra.cs.ldap.ZAttributes;
/*     */ import com.zimbra.cs.ldap.ZLdapContext;
/*     */ import com.zimbra.cs.ldap.ZLdapFilter;
/*     */ import com.zimbra.cs.ldap.ZLdapFilterFactory;
/*     */ import com.zimbra.cs.ldap.ZSearchScope;
/*     */ import java.util.List;
/*     */ import java.util.TreeSet;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class ADGroupHandler
/*     */   extends GroupHandler
/*     */ {
/*     */   private static final String MAIL_ATTR = "mail";
/*     */   private static final String MEMBER_OF_ATTR = "memberOf";
/*     */   
/*     */   public boolean isGroup(IAttributes ldapAttrs)
/*     */   {
/*     */     try
/*     */     {
/*  55 */       List<String> objectclass = ldapAttrs.getMultiAttrStringAsList("objectClass", IAttributes.CheckBinary.NOCHECK);
/*     */       
/*  57 */       return objectclass.contains("group");
/*     */     } catch (ServiceException e) {
/*  59 */       ZimbraLog.gal.warn("unable to get attribute objectClass", e);
/*     */     }
/*  61 */     return false;
/*     */   }
/*     */   
/*     */   public String[] getMembers(ILdapContext ldapContext, String searchBase, String entryDN, IAttributes ldapAttrs)
/*     */     throws ServiceException
/*     */   {
/*  67 */     if (ZimbraLog.gal.isDebugEnabled()) {
/*     */       try {
/*  69 */         ZimbraLog.gal.debug("Fetching members for group " + ldapAttrs.getAttrString("mail") + " [" + entryDN + "]");
/*     */       }
/*     */       catch (ServiceException e)
/*     */       {
/*  73 */         ZimbraLog.gal.debug("unable to get email address of group " + entryDN, e);
/*     */       }
/*     */     }
/*     */     
/*  77 */     SearchADGroupMembers searcher = new SearchADGroupMembers();
/*  78 */     TreeSet<String> result = searcher.searchLdap(ldapContext, searchBase, entryDN);
/*  79 */     return (String[])result.toArray(new String[result.size()]);
/*     */   }
/*     */   
/*     */   private static class SearchADGroupMembers
/*     */     extends SearchLdapOptions.SearchLdapVisitor
/*     */   {
/*  85 */     TreeSet<String> result = new TreeSet();
/*     */     
/*     */     SearchADGroupMembers() {
/*  88 */       super();
/*     */     }
/*     */     
/*     */     public void visit(String dn, IAttributes ldapAttrs)
/*     */     {
/*     */       try
/*     */       {
/*  95 */         String email = ldapAttrs.getAttrString("mail");
/*  96 */         if (email != null) {
/*  97 */           this.result.add(email);
/*     */         }
/*     */       }
/*     */       catch (ServiceException e) {
/* 101 */         ZimbraLog.gal.warn("unable to get attribute mail from search result", e);
/*     */       }
/*     */     }
/*     */     
/*     */     private TreeSet<String> searchLdap(ILdapContext zlc, String searchBase, String dnOfGroup)
/*     */     {
/* 107 */       ZLdapFilter filter = ZLdapFilterFactory.getInstance().memberOf(dnOfGroup);
/* 108 */       String[] returnAttrs = { "mail" };
/*     */       try
/*     */       {
/* 111 */         LdapHelper ldapHelper = LdapProv.getInst().getHelper();
/* 112 */         SearchLdapOptions searchOptions = new SearchLdapOptions(searchBase, filter, returnAttrs, 0, null, ZSearchScope.SEARCH_SCOPE_SUBTREE, this);
/*     */         
/*     */ 
/* 115 */         ldapHelper.searchLdap(zlc, searchOptions);
/*     */       }
/*     */       catch (ServiceException e) {
/* 118 */         ZimbraLog.gal.warn("unable to search group members", e);
/*     */       }
/*     */       
/* 121 */       return this.result;
/*     */     }
/*     */   }
/*     */   
/*     */   public ZLdapContext getExternalDelegatedAdminGroupsLdapContext(Domain domain, boolean asAdmin)
/*     */     throws ServiceException
/*     */   {
/* 128 */     if (!domainAdminAuthMechIsAD(domain, asAdmin)) {
/* 129 */       throw ServiceException.INVALID_REQUEST("domain auth mech must be AD", null);
/*     */     }
/*     */     
/* 132 */     return super.getExternalDelegatedAdminGroupsLdapContext(domain, asAdmin);
/*     */   }
/*     */   
/*     */   private static boolean domainAdminAuthMechIsAD(Domain domain, boolean asAdmin) {
/* 136 */     return asAdmin ? AuthMechanism.AuthMech.ad.name().equals(domain.getAuthMechAdmin()) : AuthMechanism.AuthMech.ad.name().equals(domain.getAuthMech());
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private boolean legitimateDelegatedAdminAsGroupMember(ExternalGroup group, Account acct, boolean asAdmin)
/*     */     throws ServiceException
/*     */   {
/* 149 */     String zimbraDomainId = group.getZimbraDomainId();
/* 150 */     Domain domain = Provisioning.getInstance().getDomain(acct);
/*     */     
/* 152 */     if (domain == null) {
/* 153 */       return false;
/*     */     }
/*     */     
/* 156 */     if (!domainAdminAuthMechIsAD(domain, asAdmin)) {
/* 157 */       return false;
/*     */     }
/*     */     
/* 160 */     if (!domain.getId().equals(zimbraDomainId)) {
/* 161 */       return false;
/*     */     }
/*     */     
/* 164 */     return true;
/*     */   }
/*     */   
/*     */ 
/*     */   public boolean inDelegatedAdminGroup(ExternalGroup group, Account acct, boolean asAdmin)
/*     */     throws ServiceException
/*     */   {
/* 171 */     if (!legitimateDelegatedAdminAsGroupMember(group, acct, asAdmin)) {
/* 172 */       return false;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/* 177 */     List<String> groupDNs = (List)acct.getCachedData(EntryCacheDataKey.GROUPEDENTRY_EXTERNAL_GROUP_DNS);
/*     */     
/*     */ 
/* 180 */     if (groupDNs != null) {
/* 181 */       return groupDNs.contains(group.getDN());
/*     */     }
/*     */     
/*     */ 
/* 185 */     groupDNs = getDelegatedAdminGroups(acct, asAdmin);
/*     */     
/* 187 */     acct.setCachedData(EntryCacheDataKey.GROUPEDENTRY_EXTERNAL_GROUP_DNS, groupDNs);
/*     */     
/* 189 */     return groupDNs.contains(group.getDN());
/*     */   }
/*     */   
/*     */   private List<String> getDelegatedAdminGroups(Account acct, boolean asAdmin) throws ServiceException {
/* 193 */     LdapProv prov = LdapProv.getInst();
/*     */     
/* 195 */     Domain domain = prov.getDomain(acct);
/* 196 */     if (domain == null) {
/* 197 */       throw ServiceException.FAILURE("unable to get domain for account " + acct.getName(), null);
/*     */     }
/*     */     
/*     */ 
/*     */ 
/* 202 */     String extDN = acct.getAuthLdapExternalDn();
/* 203 */     if (extDN == null)
/*     */     {
/*     */ 
/*     */ 
/* 207 */       String dnTemplate = domain.getAuthLdapBindDn();
/* 208 */       if (dnTemplate != null) {
/* 209 */         extDN = LdapUtil.computeDn(acct.getName(), dnTemplate);
/*     */       }
/*     */     }
/*     */     
/* 213 */     if (extDN == null) {
/* 214 */       throw ServiceException.FAILURE("unable to get external DN for account " + acct.getName(), null);
/*     */     }
/*     */     
/*     */ 
/* 218 */     ZLdapContext zlc = null;
/*     */     try {
/* 220 */       zlc = getExternalDelegatedAdminGroupsLdapContext(domain, asAdmin);
/*     */       
/* 222 */       ZAttributes attrs = prov.getHelper().getAttributes(zlc, extDN, new String[] { "memberOf" });
/*     */       
/* 224 */       return attrs.getMultiAttrStringAsList("memberOf", IAttributes.CheckBinary.NOCHECK);
/*     */     } finally {
/* 226 */       LdapClient.closeContext(zlc);
/*     */     }
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/cs/account/grouphandler/ADGroupHandler.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */